BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Advisory 2022-05-17

2022-05-17 May 17, 2022 Source: Vendor

Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2022-05-17/. 14 SECURITY issues listed. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.jenkins.io/security/advisory/2022-05-17/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

13 lines
All 13 CVEs 13 Additional recognition 0 Unclaimed only
Showing 1–13 of 13
CVE-2022-30971 BR2022-0000-011724 SECURITY-1969 unclaimed
XXE vulnerability in Storable Configs Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-30947 BR2022-0000-011725 SECURITY-2478 unclaimed
Multiple SCM plugins can check out from the controller file system
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-30945 BR2022-0000-011726 SECURITY-359 unclaimed
Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin
Credited as Jesse Glick, CloudBees, Inc.
CVE-2022-30950 BR2022-0000-011727 SECURITY-2604 unclaimed
Multiple vulnerabilities in Windows Remote Command library in windows-slaves Plugin
Credited as Kalle Niemitalo, Procomp Solutions Oy
CVE-2022-30970 BR2022-0000-011728 SECURITY-2267 unclaimed
Stored XSS vulnerability in Autocomplete Parameter Plugin
Credited as Kevin Guerroudj
CVE-2022-30956 BR2022-0000-011729 SECURITY-2600 unclaimed
Stored XSS vulnerability in Rundeck Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-30955 BR2022-0000-011730 SECURITY-2753 unclaimed
Missing permission check in GitLab Plugin allows enumerating credentials IDs
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2022-30960 BR2022-0000-011731 SECURITY-2717 unclaimed
Stored XSS vulnerabilities in multiple plugins providing additional parameter types
Credited as Kevin Guerroudj, CloudBees, Inc., Wadeck Follonier, CloudBees, Inc.
CVE-2022-30960 BR2022-0000-011732 SECURITY-2717 unclaimed
Stored XSS vulnerabilities in multiple plugins providing additional parameter types
Credited as Daniel Beck, CloudBees, Inc.
CVE-2022-30969 BR2022-0000-011733 SECURITY-2322 unclaimed
CSRF vulnerability in Autocomplete Parameter Plugin results in RCE
Credited as Kevin Guerroudj, Justin Philip, Marc Heyries, Wadeck Follonier, CloudBees, Inc.
CVE-2022-30958 BR2022-0000-011734 SECURITY-2093 unclaimed
CSRF vulnerability and missing permission checks in SSH Plugin allow capturing credentials
Credited as Long Nguyen, Viettel Cyber Security
CVE-2022-30953 BR2022-0000-011735 SECURITY-2502 unclaimed
CSRF vulnerability and missing permission checks in Blue Ocean Plugin
Credited as Tanner Emek from Tinder Security Labs
CVE-2022-30957 BR2022-0000-011736 SECURITY-2315 unclaimed
Missing permission check in SSH Plugin allows enumerating credentials IDs
Credited as Wadeck Follonier, CloudBees, Inc.